@1agh/maude 0.60.3 → 0.60.5

package/apps/studio/sync/tombstone-apply.ts

@@ -0,0 +1,131 @@
+// Acting on a tombstone — the peer-side half of the delete lane.
+//
+// The hub states that a canvas is gone (`tombstones.mjs`); this is what a peer
+// does about it. One rule governs the whole file:
+//
+//   QUARANTINE, NEVER DELETE.
+//
+// This is the only code path where a HUB-SUPPLIED signal removes work from a
+// person's disk, and the hub is untrusted to peers (DDR-054). Moving the bundle
+// to `_trash/<slug>-deleted-<ts>/` is what makes that acceptable: a hub that is
+// hostile, buggy, or simply confused about which project it is costs the user a
+// trip to `_trash/`, never their work. The same posture, and the same directory,
+// `migrate-flat-fallback.ts` already established for a peer-driven move.
+//
+// WHY THE SIDECARS TRAVEL AND THE HISTORY DOES NOT. The lanes that ARE the
+// canvas — body, `.meta.json`, `.css`, `.annotations.svg` — move together, so
+// what lands in `_trash/` is a restorable canvas rather than a body stripped of
+// its annotations. `_history/<slug>/`, `_comments/`, `_canvas-state/` stay: they
+// are per-machine runtime state (DDR-115), regenerated or irrelevant, and
+// sweeping them would make a recoverable delete quietly lossy.
+
+import { existsSync, mkdirSync, renameSync } from 'node:fs';
+import path from 'node:path';
+
+/**
+ * Park ONE file in `_trash/<rel>-conflict-<ts>` — the file plane's LWW
+ * loser's parking spot (feature-sync-file-plane), generalized out of
+ * `quarantineCanvas` below: same posture (quarantine, never delete; never
+ * throw — a failed quarantine costs the overwrite, not the sync runtime),
+ * scoped to a single file rather than a canvas's lane bundle.
+ *
+ * Returns the design-root-relative destination, or null when nothing moved —
+ * and the CALLER must treat null as "do not overwrite": a conflict loser
+ * that could not be parked is a conflict loser that stays.
+ */
+export function quarantineFile(opts: {
+  designRoot: string;
+  /** Design-root-relative path of the file to park. */
+  rel: string;
+  now?: number;
+  log?: (line: string) => void;
+}): string | null {
+  const { designRoot, rel } = opts;
+  const log = opts.log ?? ((line: string) => console.log(line));
+  const abs = path.join(designRoot, rel);
+  if (!existsSync(abs)) return null;
+  const trashedTo = `_trash/${rel}-conflict-${opts.now ?? Date.now()}`;
+  const trashAbs = path.join(designRoot, trashedTo);
+  try {
+    mkdirSync(path.dirname(trashAbs), { recursive: true });
+    renameSync(abs, trashAbs);
+  } catch (err) {
+    log(
+      `[sync/files] could not park ${rel} in _trash/: ${(err as Error).message} — keeping the local copy`
+    );
+    return null;
+  }
+  log(`[sync/files] conflict on ${rel} — the local copy moved to ${trashedTo}`);
+  return trashedTo;
+}
+
+export interface TombstoneMove {
+  slug: string;
+  /** Design-root-relative quarantine dir the canvas landed in. */
+  trashedTo: string;
+  /** Design-root-relative lanes that actually moved. */
+  moved: string[];
+}
+
+/** The absolute paths that make up one canvas on disk. */
+export interface CanvasLanes {
+  html: string;
+  meta?: string;
+  css?: string;
+  annotations?: string;
+}
+
+/**
+ * Move one canvas's lanes into `_trash/`, best-effort.
+ *
+ * Returns the move, or null when there was nothing on disk to move (already
+ * gone — the idempotent steady state once both peers have converged) or when the
+ * quarantine directory could not be made. NEVER THROWS: a failed quarantine must
+ * cost the deletion, not the sync runtime that called it.
+ *
+ * `now` is injectable so a test does not have to reason about wall-clock.
+ */
+export function quarantineCanvas(opts: {
+  designRoot: string;
+  slug: string;
+  lanes: CanvasLanes;
+  now?: number;
+  log?: (line: string) => void;
+}): TombstoneMove | null {
+  const { designRoot, slug, lanes } = opts;
+  const log = opts.log ?? ((line: string) => console.log(line));
+  const present = [lanes.html, lanes.meta, lanes.css, lanes.annotations].filter(
+    (p): p is string => !!p && existsSync(p)
+  );
+  if (present.length === 0) return null;
+
+  const trashedTo = `_trash/${slug}-deleted-${opts.now ?? Date.now()}`;
+  const trashAbs = path.join(designRoot, trashedTo);
+  try {
+    mkdirSync(trashAbs, { recursive: true });
+  } catch (err) {
+    log(
+      `[sync/tombstone] could not quarantine ${slug}: ${(err as Error).message} — leaving it in place`
+    );
+    return null;
+  }
+
+  const moved: string[] = [];
+  for (const abs of present) {
+    try {
+      renameSync(abs, path.join(trashAbs, path.basename(abs)));
+      moved.push(path.relative(designRoot, abs));
+    } catch (err) {
+      // One stuck lane (an open handle on Windows, a permission quirk) must not
+      // abandon the lanes that CAN move — a half-moved canvas is still gone from
+      // the tree, and the remainder is named here so it can be found by hand.
+      log(
+        `[sync/tombstone] could not move ${path.basename(abs)} for ${slug}: ${(err as Error).message}`
+      );
+    }
+  }
+  if (moved.length === 0) return null;
+
+  log(`[sync/tombstone] ${slug} was deleted in the project — moved to ${trashedTo}/`);
+  return { slug, trashedTo, moved };
+}

package/apps/studio/test/canvas-meta-api.test.ts

@@ -115,7 +115,7 @@ describe('/_api/canvas-meta — GET/PATCH (DDR-115 camera split)', () => {
     }
   });
 
-  test('PATCH clamps zoom to [0.1, 4.0]', async () => {
+  test('PATCH clamps zoom to [0.02, 4.0]', async () => {
     const { root, designRoot } = makeSandbox();
     const port = nextPort();
     const proc = await bootServer(root, port);
@@ -137,10 +137,45 @@ describe('/_api/canvas-meta — GET/PATCH (DDR-115 camera split)', () => {
       const r2 = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
         method: 'PATCH',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ file, patch: { viewport: { x: 0, y: 0, zoom: 0.001 } } }),
+        body: JSON.stringify({ file, patch: { viewport: { x: 0, y: 0, zoom: 0.0001 } } }),
       });
       const m2 = (await r2.json()) as MetaShape;
-      expect(m2.viewport?.zoom).toBe(0.1);
+      expect(m2.viewport?.zoom).toBe(0.02);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  // Issue #91 — a board wider than ~10x the viewport needs a zoom below the
+  // OLD 0.1 floor to ever be framed whole ("fit to screen") or dragged across
+  // in one motion. Before the fix, this value was silently re-clamped up to
+  // 0.1 on save, so even a client that could reach 0.05 lost it on reload.
+  test('PATCH preserves a deep zoom-out that the old [0.1, 4.0] floor used to clamp away (issue #91)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      const tsxAbs = join(designRoot, 'ui', 'DeepZoom.tsx');
+      writeFileSync(tsxAbs, 'export default function D(){return <main/>}\n');
+      writeFileSync(tsxAbs.replace(/\.tsx$/, '.meta.json'), '{"title":"DeepZoom"}');
+      const file = repoRel(designRoot, tsxAbs);
+
+      const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { viewport: { x: 0, y: 0, zoom: 0.05 } } }),
+      });
+      const m = (await r.json()) as MetaShape;
+      expect(m.viewport?.zoom).toBe(0.05);
+
+      // Round-trips through a fresh GET too (the persisted view file, not just
+      // the PATCH response) — this is what a page reload would read back.
+      const g = await fetch(
+        `http://localhost:${port}/_api/canvas-meta?file=${encodeURIComponent(file)}`
+      );
+      const gm = (await g.json()) as MetaShape;
+      expect(gm.viewport?.zoom).toBe(0.05);
     } finally {
       await killProc(proc);
     }
@@ -317,6 +352,82 @@ describe('/_api/canvas-meta — GET/PATCH (DDR-115 camera split)', () => {
     }
   });
 
+  // Security follow-up to issue #91 — `layout.artboards[]` is reachable from
+  // the untrusted canvas origin (DDR-054) and previously had no count/magnitude
+  // bound. Now that the zoom-floor fix lets `fit()` correctly frame whatever
+  // bounding box a synced layout describes, an unbounded artboard count could
+  // promote hundreds/thousands of simultaneous GPU layers on the viewer's
+  // client (a DoS). Caps mirror the existing overlays/locked lanes.
+  test('PATCH layout rejects an oversized artboards array as a silent no-op', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      const tsxAbs = join(designRoot, 'ui', 'Oversized.tsx');
+      writeFileSync(tsxAbs, 'export default function O(){return <main/>}\n');
+      const metaAbs = tsxAbs.replace(/\.tsx$/, '.meta.json');
+      writeFileSync(metaAbs, JSON.stringify({ title: 'Oversized', sections: [] }));
+      const file = repoRel(designRoot, tsxAbs);
+
+      // Seed a valid, small layout first.
+      await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { layout: { artboards: [{ id: 'a', x: 0, y: 0 }] } } }),
+      });
+
+      // A crafted, oversized layout (2001 > the 2000-entry cap) must not land.
+      const huge = Array.from({ length: 2001 }, (_, i) => ({ id: `a${i}`, x: i, y: 0 }));
+      const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { layout: { artboards: huge } } }),
+      });
+      expect(r.status).toBe(200);
+      const merged = (await r.json()) as MetaShape;
+      // Silent no-op — the prior small, valid layout is still what's live.
+      const arts = merged.layout?.artboards as Array<Record<string, unknown>> | undefined;
+      expect(arts).toEqual([{ id: 'a', x: 0, y: 0 }]);
+
+      const onDisk = JSON.parse(readFileSync(metaAbs, 'utf8')) as MetaShape;
+      const diskArts = onDisk.layout?.artboards as Array<Record<string, unknown>> | undefined;
+      expect(diskArts).toEqual([{ id: 'a', x: 0, y: 0 }]);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('PATCH layout rejects an out-of-range artboard coordinate as a silent no-op', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      const tsxAbs = join(designRoot, 'ui', 'OutOfRange.tsx');
+      writeFileSync(tsxAbs, 'export default function R(){return <main/>}\n');
+      writeFileSync(
+        tsxAbs.replace(/\.tsx$/, '.meta.json'),
+        JSON.stringify({ title: 'OutOfRange' })
+      );
+      const file = repoRel(designRoot, tsxAbs);
+
+      const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          file,
+          patch: { layout: { artboards: [{ id: 'a', x: 50_000_000, y: 0 }] } },
+        }),
+      });
+      expect(r.status).toBe(200);
+      const merged = (await r.json()) as MetaShape;
+      expect(merged.layout).toBeUndefined();
+    } finally {
+      await killProc(proc);
+    }
+  });
+
   test('PATCH viewport on a non-existent canvas is refused (404) and mints no file (DDR-115 F-A2)', async () => {
     const { root, designRoot } = makeSandbox();
     const port = nextPort();

package/apps/studio/test/canvas-zoom-floor.test.ts

@@ -0,0 +1,73 @@
+// canvas-zoom-floor — issue #91 dogfood report: dragging an artboard across a
+// large board, the user can't zoom out far enough to complete the move in one
+// motion. Root cause: `clampZoom` applies a single hard-coded floor to every
+// viewport write, including the programmatic `fit()` path — a board wider
+// than ~10x the viewport could never be framed whole. See
+// .ai/logs/rca/issue-91-canvas-zoom-floor.md.
+//
+// canvas-lib.tsx pulls in a React/DOM dependency graph, so we register
+// happy-dom for this file (like camera-reveal.test.tsx) before importing.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { GlobalRegistrator } from '@happy-dom/global-registrator';
+
+beforeAll(() => {
+  GlobalRegistrator.register();
+});
+afterAll(() => {
+  GlobalRegistrator.unregister();
+});
+
+import { clampZoom, computeFit } from '../canvas-lib.tsx';
+
+function fakeHost(clientWidth: number, clientHeight: number): HTMLElement {
+  const el = document.createElement('div');
+  Object.defineProperty(el, 'clientWidth', { value: clientWidth });
+  Object.defineProperty(el, 'clientHeight', { value: clientHeight });
+  return el;
+}
+
+describe('clampZoom — the interactive zoom floor (issue #91)', () => {
+  test('a deep zoom-out below the OLD 0.1 floor is no longer clamped', () => {
+    expect(clampZoom(0.05)).toBe(0.05);
+    expect(clampZoom(0.02)).toBe(0.02);
+  });
+
+  test('still clamps below the new floor', () => {
+    expect(clampZoom(0.0001)).toBe(0.02);
+    expect(clampZoom(-5)).toBe(0.02);
+  });
+
+  test('still clamps above the max and normalizes non-finite input', () => {
+    expect(clampZoom(99)).toBe(4);
+    expect(clampZoom(Number.NaN)).toBe(1);
+    expect(clampZoom(Number.POSITIVE_INFINITY)).toBe(1);
+  });
+});
+
+describe('computeFit → clampZoom — fit() can now frame a wide board (issue #91)', () => {
+  test('a board ~20x the viewport width computes a zoom the old floor would have clamped up', () => {
+    // Viewport 1000x800; board 20000 wide — the exact "more than a screenful
+    // of artboards" shape from the report. Ideal fit zoom is well under 0.1.
+    const host = fakeHost(1000, 800);
+    const fit = computeFit([{ x: 0, y: 0, w: 20000, h: 800 }], host, 24);
+
+    expect(fit.zoom).toBeLessThan(0.1); // the bug: old floor would have clamped this
+    expect(fit.zoom).toBeGreaterThanOrEqual(0.02); // still within the new interactive floor
+
+    // The regression proper: applying the viewport funnel's clamp must be a
+    // no-op for this value now — before the fix (ZOOM_MIN = 0.1) this would
+    // have raised fit.zoom back up to 0.1, cropping the board.
+    expect(clampZoom(fit.zoom)).toBe(fit.zoom);
+  });
+
+  test('an extremely wide board (>50x viewport) still bottoms out at the interactive floor', () => {
+    const host = fakeHost(1000, 800);
+    const fit = computeFit([{ x: 0, y: 0, w: 100000, h: 800 }], host, 24);
+
+    // The ideal fit zoom is far below even the new floor — clampZoom must
+    // still protect the interactive floor for pathological board sizes.
+    expect(fit.zoom).toBeLessThan(0.02);
+    expect(clampZoom(fit.zoom)).toBe(0.02);
+  });
+});

package/apps/studio/test/cloud-managed-save-surfaces.test.ts

@@ -0,0 +1,90 @@
+// DDR-218's withdrawal, applied to EVERY surface that reports a save state.
+//
+// The decision withdrew the working-tree half of the Changes surface whenever
+// somebody else commits this project — a cloud cell (`historyOnly`, `cfg.cloud`)
+// or the cell behind a linked+credentialed desktop repo (`cloudManaged`). It
+// landed in GitPanel only. `app.jsx` went on computing the dirty count a second
+// time, ungated, and handing it to the toolbar menu and the status-bar chip, so
+// both shells kept rendering "N unsaved" — the exact claim the withdrawal exists
+// to delete. Reported again 2026-08-14 ("89 unsaved changes on the cloud, 36 on
+// the desktop"), which is what these assertions are here to stop.
+//
+// Source-level (sync-panel-surface style): what they pin is what would regress —
+// someone re-deriving the posture at a call site, or adding a THIRD surface that
+// reads `gitStatus.files.length` directly.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+const PANEL = readFileSync(join(STUDIO, 'client', 'panels', 'GitPanel.jsx'), 'utf8');
+
+describe('one expression owns "who is saving this project"', () => {
+  test('both postures are named once, at the top level', () => {
+    expect(APP).toContain('const cellManaged = !!cfg.cloud;');
+    expect(APP).toContain('const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;');
+    expect(APP).toContain('const savingIsManaged = cellManaged || cloudManaged;');
+  });
+
+  test('the GitPanel call site consumes those names rather than re-deriving them', () => {
+    // Re-deriving is how the two halves drift apart in the first place.
+    expect(APP).toContain('historyOnly={cellManaged}');
+    expect(APP).toContain('cloudManaged={cloudManaged}');
+  });
+});
+
+describe('the dirty COUNT is withheld wherever saving is managed', () => {
+  test('unsavedCount is gated, not raw', () => {
+    expect(APP).toContain(
+      'const unsavedCount = savingIsManaged ? 0 : gitStatus?.files?.length || 0;'
+    );
+  });
+
+  test('no surface reads the raw file count for display', () => {
+    // Exactly one `gitStatus?.files?.length` may exist, and it is the gated one
+    // above. A second occurrence is a new leak by construction.
+    const raw = APP.match(/gitStatus\?\.files\?\.length/g) ?? [];
+    expect(raw.length).toBe(1);
+  });
+
+  test('every changesCount consumer is fed the gated value', () => {
+    const feeds = APP.match(/changesCount=\{[^}]+\}/g) ?? [];
+    expect(feeds.length).toBeGreaterThan(0);
+    for (const feed of feeds) expect(feed).toBe('changesCount={unsavedCount}');
+  });
+});
+
+describe('the status-bar chip names the mechanism instead of a count', () => {
+  test('it receives the posture', () => {
+    expect(APP).toContain('savingIsManaged={savingIsManaged}');
+    expect(APP).toMatch(/savingIsManaged = false,/);
+  });
+
+  test('managed saving short-circuits the whole unsaved / to-publish ladder', () => {
+    expect(APP).toMatch(/\{savingIsManaged\s*\?/);
+    expect(APP).toContain("'cloud saving'");
+  });
+
+  test('"N to publish" is withheld too — Publish is withdrawn in that posture', () => {
+    // A gated count alone would fall through to the unpushed branch, which is
+    // the same local-git offer wearing a different label.
+    expect(APP).toContain('unpushed={savingIsManaged ? 0 : gitStatus?.unpushed || 0}');
+  });
+});
+
+describe('the panel half of DDR-218 is still intact', () => {
+  test('withdrawal covers both postures', () => {
+    expect(PANEL).toContain('const withdrawn = historyOnly || cloudManaged;');
+  });
+
+  test('the panel badge stays gated on it', () => {
+    expect(PANEL).toMatch(/!withdrawn && count > 0/);
+  });
+
+  test('the cloud-managed note keeps its testid and names the live mechanism', () => {
+    expect(PANEL).toContain('data-testid="git-cloud-managed"');
+    expect(PANEL).toMatch(/Cloud is saving/);
+  });
+});

package/apps/studio/test/dom-selection.test.ts

@@ -19,7 +19,7 @@ afterAll(() => {
   GlobalRegistrator.unregister();
 });
 
-import { resolveByDomPath } from '../dom-selection.ts';
+import { buildComposeSelection, openCommentComposer, resolveByDomPath } from '../dom-selection.ts';
 
 function setArtboard(html: string): void {
   document.body.innerHTML = `<div data-dc-screen="art1">${html}</div>`;
@@ -128,3 +128,71 @@ describe('resolveByDomPath', () => {
     expect(found?.getAttribute('data-cd-id')).toBe('aaa11111');
   });
 });
+
+// issue-90 — right-click "Add comment" on empty canvas background or an
+// artboard's chrome/border (neither carries a `data-cd-id`) used to have no
+// menu entry at all, and even where the entry DID exist (on an element) it
+// never actually opened the composer (see `openCommentComposer` below).
+// `buildComposeSelection` is the shared builder canvas-shell.tsx's
+// context-menu registry now calls for all three target kinds.
+describe('buildComposeSelection', () => {
+  test('with an element under the cursor — delegates to hoverTargetToSelection (same anchor a comment-tool click gets)', () => {
+    setArtboard(`<button class="cta" data-cd-id="aaa11111">Buy now</button>`);
+    const el = document.querySelector('[data-cd-id="aaa11111"]');
+    const sel = buildComposeSelection({ el, cdId: 'aaa11111', artboardId: 'art1' }, 100, 200);
+    expect(sel.selector).toBe('[data-dc-screen="art1"] [data-cd-id="aaa11111"]');
+    expect(sel.id).toBe('aaa11111');
+    expect(sel.tag).toBe('button');
+  });
+
+  test('with no element (empty canvas background) — a FLOATING selection anchored to the click point', () => {
+    document.body.innerHTML = '';
+    const sel = buildComposeSelection({ el: null, cdId: null, artboardId: null }, 100, 200);
+    expect(sel.selector).toBe('');
+    expect(sel.tag).toBe('');
+    expect(sel.artboardId).toBeNull();
+    expect(sel.bounds).toEqual({ x: 88, y: 188, w: 24, h: 24 });
+  });
+
+  test('with no element but INSIDE an artboard (right-click on its chrome/border) — floating, but keeps the artboardId', () => {
+    document.body.innerHTML = '';
+    const sel = buildComposeSelection({ el: null, cdId: null, artboardId: 'art1' }, 50, 60);
+    expect(sel.selector).toBe('');
+    expect(sel.artboardId).toBe('art1');
+    expect(sel.bounds).toEqual({ x: 38, y: 48, w: 24, h: 24 });
+  });
+});
+
+describe('openCommentComposer', () => {
+  // The regression: canvas-shell.tsx's context-menu "Add comment" used to
+  // ONLY postMessage the parent shell (which merely mirrors the target for
+  // the StatusBar/sidebar) and never dispatched `cm:open-composer` — the one
+  // event `comments-overlay.tsx` listens on to actually render the composer.
+  // Selecting the menu item silently did nothing.
+  test('dispatches cm:open-composer carrying the selection + click point', () => {
+    let detail: { selection?: unknown; clientX?: number; clientY?: number } | null = null;
+    const onOpen = (e: Event) => {
+      detail = (e as CustomEvent).detail;
+    };
+    document.addEventListener('cm:open-composer', onOpen);
+    const sel = {
+      selector: '',
+      artboardId: null,
+      tag: '',
+      classes: '',
+      text: '',
+      dom_path: [],
+      bounds: { x: 30, y: 40, w: 24, h: 24 },
+      html: '',
+    };
+    try {
+      openCommentComposer(sel, 42, 52);
+    } finally {
+      document.removeEventListener('cm:open-composer', onOpen);
+    }
+    expect(detail).not.toBeNull();
+    expect(detail?.selection).toBe(sel);
+    expect(detail?.clientX).toBe(42);
+    expect(detail?.clientY).toBe(52);
+  });
+});

package/apps/studio/test/exporters/jobs.test.ts

@@ -53,7 +53,11 @@ describe('exporters/jobs — concurrency gate', () => {
       let sawThirdQueued = false;
       let maxRunningObserved = 0;
       let allDone = false;
-      const deadline = Date.now() + 4000;
+      // Generous: the assertion below is "the queue drains at all", not "it
+      // drains fast". The budget only has to outlast DEFLATE over the seeded
+      // sandbox on the slowest machine we run on — a budget tuned to one
+      // machine's disk speed fails there while the queue is working fine.
+      const deadline = Date.now() + 20_000;
       while (Date.now() < deadline && !allDone) {
         const jobs = await listJobs(port);
         const byId = new Map(jobs.map((j) => [j.id, j]));
@@ -74,7 +78,7 @@ describe('exporters/jobs — concurrency gate', () => {
     } finally {
       await killProc(proc);
     }
-  });
+  }, 30_000);
 });
 
 describe('exporters/jobs — pending-queue cap (security fan-out, /flow:done)', () => {
@@ -109,7 +113,9 @@ describe('exporters/jobs — pending-queue cap (security fan-out, /flow:done)',
       // Once jobs drain below the cap, enqueue works again — this is a
       // capacity limit, not a permanent lockout.
       let drained = false;
-      const deadline = Date.now() + 5000;
+      // Same reasoning as the concurrency gate above — budget for the slowest
+      // machine, since what's under test is that the cap lifts, not latency.
+      const deadline = Date.now() + 20_000;
       while (Date.now() < deadline && !drained) {
         const jobs = await listJobs(port);
         drained = jobs.every((j) => j.status === 'done' || j.status === 'failed');
@@ -121,7 +127,7 @@ describe('exporters/jobs — pending-queue cap (security fan-out, /flow:done)',
     } finally {
       await killProc(proc);
     }
-  });
+  }, 30_000);
 });
 
 describe('exporters/jobs — list() + history under concurrency', () => {

package/apps/studio/test/git-cloud-posture.test.ts

@@ -37,8 +37,17 @@ describe('a cloud-linked repo shows ONE save mechanism (DDR-218)', () => {
   });
 
   test('the app gate is the CORROBORATED link, and the cell posture is untouched', () => {
-    expect(APP).toContain('cloudManaged={!cfg.cloud && !!cloudLinkedHub?.credentialed}');
-    expect(APP).toContain('historyOnly={!!cfg.cloud}');
+    // Hoisted to a single top-level definition (2026-08-14) so the toolbar and
+    // status bar read the SAME posture the panel does — see
+    // cloud-managed-save-surfaces.test.ts. The gate itself is unchanged, and
+    // `credentialed` is the load-bearing half: config.json alone is
+    // attacker-authorable (B2), so a link claim without corroboration must
+    // never reach this posture.
+    expect(APP).toContain('const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;');
+    expect(APP).toContain('const cellManaged = !!cfg.cloud;');
+    // …and the panel is fed from those names, not a re-derivation.
+    expect(APP).toContain('cloudManaged={cloudManaged}');
+    expect(APP).toContain('historyOnly={cellManaged}');
   });
 
   test('CloudBar lifts every link change the posture depends on', () => {

package/apps/studio/test/input-router.test.ts

@@ -9,6 +9,7 @@ import {
   DRAG_THRESHOLD_PX,
   isArtboardDragChrome,
   isEditableTarget,
+  isOverlayTarget,
   type Tool,
   yieldsClickToArtboardChrome,
   yieldsToArtboardDrag,
@@ -496,6 +497,74 @@ describe('input-router / isArtboardDragChrome', () => {
   });
 });
 
+// issue-90 — once comment mode is armed, a bare click anywhere on the shell's
+// floating chrome (tool palette, zoom pill, minimap, right-click context
+// menu) was claimed as `drop-comment` and dropped a stray pin at the
+// chrome's own coordinates instead of reaching the chrome's own React
+// onClick — the palette became unusable the moment the user picked the
+// Comment tool. `classifyContextKind` (canvas-shell.tsx) already treats
+// these same selectors as non-canvas `'overlay'` chrome; `isOverlayTarget`
+// was the one claim gate that didn't.
+describe('input-router / isOverlayTarget — shell chrome exemptions (issue-90)', () => {
+  // isOverlayTarget makes ONE `closest(a, b, c, ...)` call against the full
+  // comma-joined selector list, unlike isArtboardDragChrome's fakeTarget
+  // above (which mimics one call per bare selector) — so the stub instead
+  // checks whether any of the target's own classes appears among the
+  // selector's comma-separated parts, same as a real `Element.closest` would
+  // resolve for a node carrying that class.
+  const fakeTarget = (memberOf: string[]): EventTarget =>
+    ({
+      closest: (sel: string) => (memberOf.some((cls) => sel.includes(cls)) ? {} : null),
+    }) as unknown as EventTarget;
+
+  test('null target → false', () => {
+    expect(isOverlayTarget(null)).toBe(false);
+  });
+
+  test('a click on the tool palette is exempt', () => {
+    expect(isOverlayTarget(fakeTarget(['.dc-tool-palette']))).toBe(true);
+  });
+
+  test('a click on the zoom toolbar is exempt', () => {
+    expect(isOverlayTarget(fakeTarget(['.dc-zoom-tb']))).toBe(true);
+  });
+
+  test('a click on the minimap is exempt', () => {
+    expect(isOverlayTarget(fakeTarget(['.dc-mm']))).toBe(true);
+  });
+
+  test('a click on the right-click context menu is exempt', () => {
+    expect(isOverlayTarget(fakeTarget(['.dc-context-menu']))).toBe(true);
+  });
+
+  test('a click on ordinary canvas content is NOT exempt', () => {
+    expect(isOverlayTarget(fakeTarget([]))).toBe(false);
+  });
+
+  test('the pre-existing comment-overlay exemptions still hold', () => {
+    expect(isOverlayTarget(fakeTarget(['.cm-composer']))).toBe(true);
+    expect(isOverlayTarget(fakeTarget(['.cm-thread']))).toBe(true);
+    expect(isOverlayTarget(fakeTarget(['.cm-mention-popup']))).toBe(true);
+    expect(isOverlayTarget(fakeTarget(['.cm-pin']))).toBe(true);
+    expect(isOverlayTarget(fakeTarget(['[data-mediaref-player]']))).toBe(true);
+  });
+
+  // Security review finding (issue-90) — `.dc-world` is where the ACTIVE
+  // CANVAS's own untrusted, AI/user-authored JSX renders. None of the real
+  // chrome ever lives there, so an element inside `.dc-world` that ALSO
+  // carries one of these class names is necessarily a same-name imposter —
+  // untrusted canvas content spoofing the shell's own chrome to make the
+  // router yield (skip preventDefault) on it instead of claiming the
+  // gesture. Must be rejected regardless of which chrome class it copies.
+  test('an element inside .dc-world carrying a spoofed chrome class is NOT exempt', () => {
+    expect(isOverlayTarget(fakeTarget(['.dc-world', '.dc-tool-palette']))).toBe(false);
+    expect(isOverlayTarget(fakeTarget(['.dc-world', '.dc-zoom-tb']))).toBe(false);
+    expect(isOverlayTarget(fakeTarget(['.dc-world', '.dc-mm']))).toBe(false);
+    expect(isOverlayTarget(fakeTarget(['.dc-world', '.dc-context-menu']))).toBe(false);
+    expect(isOverlayTarget(fakeTarget(['.dc-world', '.cm-composer']))).toBe(false);
+  });
+});
+
 // issue-71 — the actual regression: before this fix, useInputRouter's
 // pointerdown/mousedown handlers called `stopImmediatePropagation()` on EVERY
 // claimed action, including a bare click on an artboard's own drag chrome —